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DETAILED ACTION 
Petition to Withdraw Finality 
Applicant's petition under 37 CFR 1.181 and 1 . 182 is acknowledged and has been 
granted. Therefore, the Examiner has now issued a 2"^* Non-Final Office Action (appearing 
below). 

Response to Amendment 
Applicant's arguments/amendments with respect to amended claims 1, 11, 12, and 22 and 
previously presented claims 2-10 and 13-21 filed December 7, 2004 have been fiilly considered 
and therefore the claims are rejected under new grounds. 

Claim Rejections - 35 USC §103 

I. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

II. Claims 1-22 are rejected under 35 U.S.C. 103(a) as being unpatentable over Hailpem et 
al, United States Patent No. 6,275,937 and further in view of Trcka et al., United States Patent 
No. 6,453,345 and Tso et al,. United States Patent No. 6,088,803. 

As per claim 1 : 

Hailpern et al. substantially teach a real-time virus tracking and display system for use 
with a distributed computer network, the system comprising: a plurality of client users having 
potentially infected client computers (col. 7, lines 18-29); at least one anti-virus scanning server 
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accessible via a network, whereby the client users contact the server to facilitate virus scanning 
of the cUent computers (col. 8 Une 47 - col. 9 line 6, col. 1 1 lines 39-55, and col. 16 lines 25-37); 
and a database server associated with the virus-checking server for processing the scan log 
information into virus-tracking information (col. 9, lines 12-51). 

Not expUcitly disclosed by Hailpern et al. is the system wherein an anti-virus scanning 
server is accessible via the distributed computer network, a scan log which is sent back from 
each client user detailing certain results of the virus scanning on each client computer or a virus- 
tracking server for receiving the scan log information from said client computers in real-time. 
However Tso et al. teach that a system including a network could be modified in order for that 
system to work in a distributed network. Therefore, it would have been obvious to a person in the 
art at the time the invention was made to modify the system disclosed in Hailpern et al. to 
implement the system in a distributed network. This modification would have been obvious 
because a person having ordinary skill in the art, at the time the invention was made, would have 
been motivated to do so since it is suggested by Tso et al. in col. 8, lines 50-63. 

Furthermore, Tso et al. teach that the results of the virus check are communicated and can 
be stored in cache that exists in a network device or in a device coupled to the network device. 
Therefore, it would have been obvious to a person in the art at the time the invention was made 
to modify the system disclosed in Hailpern et al. to have the scan log communicated to the virus 
tracking server in real-time so that patterns of viruses can be monitored. This modification 
would have been obvious because a person having ordinary skill in the art, at the time the 
invention was made, would have been motivated to do so since it is suggested by Tso et al. in 
col. 5, lines 1-43. 
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Also not explicitly disclosed by Hailpern et al. is at least one virus-tracking display mode 
accessible by a tracking user from the virus-tracking server, the display mode providing real-time 
updates of said virus-tracking information pertaining to the scan logs. However, Trcka et al. 
teach object class libraries for allowing the user to select between a variety of display formats, 
including various graphs, hsts, and tables for display of report data from analysis applications. 
Therefore, it would have been obvious to a person in the art at the time the invention was made 
to modify the system disclosed in Hailpern et al. to have the collaborative server by displaying 
the occurrence of viruses so that an individual can easily recognize a viral threat to their 
computer system. This modification would have been obvious because a person having ordinary 
skill in the art, at the time the invention was made, would have been motivated to do so since it is 
suggested by Trcka et al. in col 18, line 62 - col. 19, line 61. 
As per claim 2: 

Hailpern et al. fail to teach a tracking user from the virus-tracking server, the display 
mode provides real-time updates of virus information pertaining to the scan logs. Trcka et al. 
teach object class libraries for allowing the user to select between a variety of display formats, 
including various graphs, lists, and tables for display of report data from the analysis applications 
(col. 18, lines 62-66). It would have been obvious to a person having ordinary skill in the art at 
the time of the invention was made to modify Hailpern et al.'s collaborative server by providing 
for a display of the virus-tracking information in association with graphs, Usts, and tables. 
As per claim 3: 

Hailpern et al. fail to teach display modes include a plurality of web pages with user 
selectable menus to configure the virus-tracking display on the pages, Trcka et al. teach 
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displaying a surveillance data processing module enables authorized users to interactively 
analyze and manipulate traffic data through a powerful analysis tools. This includes displaying 
user specified types of network events, conducting pattern searches of selected packet data, 
reconstructing transaction sequences, and identifying predefined network problems (col. 13, lines 
16-19). It would have been obvious to a person having ordinary skill in the art at the time of the 
invention was made to modify Hailpern et al's collaborative server by providing for web page 
selections to track specific viruses. 
As per claim 4: 

Hailpern et al. fail to teach a scan log contains no information relating to the direct 
identification of the cUent user. The automated monitor can be configured to generate a log file 
of specific types of events, such as unsuccessful logon attempts (col 17, lines 37-43). However, 
no mention is made of the direct identification of the client user. It would have been obvious to a 
person having ordinary skill in the art at the time of the invention was made to modify Hailpern 
et al.'s collaborative server by preserving the privacy of the cUent user. 
As per claim 5: 

Hailpern et al. fail to teach that the scan log includes the name of the virus, the frequency 
of its occurrence, and the geographic location of the infected computer, Trcka et al. teach any of 
a variety of known security checks can be performed on the packet data at this stage. Virus 
checking can be performed on all incoming FTP and HTTP files from unknown sites (col. 14, 
lines 60-67 and col. 15, lines 1-4). It would have been obvious to a person having ordinary skill 
in the art at the time of the invention was made to modify Hailpern et al.'s collaborative server by 
presenting a tracking scan log with virus informafion of interest to a client user. 
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As per claim 6: 

Hailpern et al. fail to teach a servlet program on the virus-tracking server is used to 
receive the scan log information from the at least one anti-virus scanning server. Trcka et al. 
teach the report generation module includes object class libraries for allowing the user to select 
between a variety of display formats, including various graphs, lists, and tables for the display of 
report data from the analysis apphcations (col. 18, lines 62-67 and col. 19, lines 1-5. It would 
have been obvious to a person having ordinary skill in the art at the time of the invention was 
made to modify Hailpern et al.'s collaborative server by allowing for the download of files to a 
program for anti-virus software. 
As per claim 7: 

Hailpern et al. fail to teach a polling program is used to regularly retrieve virus-tracking 
information from the database server and store it in a data object. Trcka et al. teach types of 
reports that can be generated using this application include the following: individual user 
activity; application activity; transaction activity; logons; and unauthorized access to restricted 
files and databases (col. 20, lines 13-17). These processes are used to track the viruses. It would 
have been obvious to a person having ordinary skill in the art at the time of the invention was 
made to modify Hailpern et al.'s collaborative server by allowing for the polling of requested 
virus information and presenting it to the client user for installation of appropriate anti-virus 
programs in one's computers. 
As per claim 8: 

Hailpern et al. fail to teach a common gateway interface program used to retrieve the data 
object for display by the tracking user. Trcka et al. teach traffic capture components, which run 
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continuously in the background, to passively generate a data stream that represents the traffic 
present on the network (col 10, lines 60-66), It would have been obvious to a person having 
ordinary skill in the art at the time of the invention was made to modify Hailpem et al.'s 
collaborative server by reporting and logging information about viruses tracking for the client 
user in order that the client may utilize the information to deploy anti- virus programs. 
As per claim 9: 

Hailpern et al. fail to teach a Java applet running on tracking user browser is used to 
display a real-time virus-tracing map. Trcka et al. teach three general types of software 
components run on the controller for the purpose of processing traffic data (col. 10, lines 59-60). 
It would have been obvious to a person having ordinary skill in the art at the time of the 
invention was made to modify Hailpern et al.'s collaborative server by adding a Java applet to 
decrease the CPU/modem time required to communicate with the server. 
As per claim 10: 

Hailpern et al. fail to teach the client user is also the tracking user. Trcka et al. teach from 
the screens, the user can specify such parameters as start time/date, end time/date, the types of 
events of interest. The user can specify search criteria and specific fields to be searched and can 
specify an output type of the display screen, the printer, or the file (col, 20, lines 5-12). It would 
have been obvious to a person having ordinary skill in the art at the time of the invention was 
made to modify Hailpern et al.'s collaborative server by allowing the client user to also be the 
user, thus allowing individuals to set-up web sights and protect their computer from viruses by 
use of the allowed operations. 
As per claim 1 1 : 
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Hailpern et al., Trcka et al., and Tso et al substantially teach the system as applied to 
claim 1 above. Furthermore, Tso et al. teach the system wherein the distributed computer 
network includes the Internet, wherein said scan log from each scanned client computer is sent 
back over the Internet to be received by said virus tracking server, and wherein said virus 
tracking display mode is accessible over the Internet by said tracking user (col. 1, lines 18-55 and 
col. 2, lines 16-53). 
As per claim 12: 

Hailpern et al. substantially teach a method to provide real-time virus tracking and 
display for use with a distributed computer network, the method comprising: providing an 
anti-virus scanning program on at least one anti-virus scanning server accessible via a computer 
network (col. 8 Une 47 - col. 9 line 6, col. 1 1 lines 39-55, and col. 16 lines 25-37); invoking the 
anti-virus scanning program from a plurality of client users having potentially infected client 
computers (col. 7, lines 18-29); and a database server associated with the virus-tracking server 
for processing the scan log information into virus-tracking information (col. 9, lines 12-51). 

Not exphcitly disclosed by Hailpern et al. is the method wherein an anti-virus scanning 
server is accessible via the distributed computer network, generating a scan log from each 
scanned client computer and sending the scan log back from each client user, the scan log 
detailing certain results of the scanning program on each client computer. However Tso et al. 
teach that a system including a network could be modified in order for that system to work in a 
distributed network. Therefore, it would have been obvious to a person in the art at the time the 
invention was made to modify the method disclosed in Hailpern et al. to implement the system in 
a distributed network. This modification would have been obvious because a person having 
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ordinary skill in the art, at the time the invention was made, would have been motivated to do so 
since it is suggested by Tso et al. in col. 8, lines 50-63. 

Furthermore, Tso et al. teach that the results of the virus check are communicated and can 
be stored in cache that exists in a network device or in a device coupled to the network device. 
Therefore, it would have been obvious to a person in the art at the time the invention was made 
to modify the method disclosed in Hailpem et al. to have the scan log communicated to the virus 
tracking server in real-time so that patterns of viruses can be monitored. This modification 
would have been obvious because a person having ordinary skill in the art, at the time the 
invention was made, would have been motivated to do so since it is suggested by Tso et al. in 
col. 5, lines 1-43. 

Also not exphcitly disclosed by Hailpern et al. is processing the scan log information into 
virus-tracking information and storing it on a database server associated with the virus-tracking 
server, and retrieving the virus-tracking information, and displaying a real-time trace on a 
tracking user device. However, Trcka et al. teach virus checking can be performed on all 
incoming FTP and HTTP files from unknown sites to analyze the data, it is passively capture. 
Furthermore, Trcka et al. teach the audit application presents the user with a set of display 
screens, which allow the user to specify various settings, and parameters for selectively viewing 
and generating audit trails from the archived traffic data. Finally, from these screens, the user can 
specify such parameters as start time/date, end time/date, and the type of events of interest. 

Therefore, it would have been obvious to a person in the art at the time the invention was 
made to modify the method disclosed in Hailpern et al. for allowing the collaborative server to 
track the virus information and store it so the analysis could be used to stop and prevent the virus 
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from infecting computers. This modification would have been obvious because a person having 
ordinary skill in the art, at the time the invention v^as made, would have been motivated to do so 
since it is suggested by Trcka et al. in col. 14 lines 62-67, col. 5 lines 1-4, and col. 20 lines 1-17. 
As per claim 13: 

Hailpern et al. fail to teach a tracking user from the virus-tracking server, the display 
mode provides real-time updates of virus information pertaining to the scan logs. Trcka et al. 
teach the Report Generation Module includes object class libraries for allowing the user to select 
between a variety of display formats, including various graphs, Usts, and tables for the display of 
report data from the analysis applications (col. 18, lines 6266). It would have been obvious to a 
person having ordinary skill in the art at the time of the invention was made to modify Hailpern 
et al.'s collaborative server by providing for a display of the virus-tracking information in 
association with geographical locations. 
As per claim 14: 

Hailpern et al. fail to teach display modes include a plurality of web pages with user 
selectable menus to configure the virus-tracking display on the pages. Trcka et al. teach the 
Surveillance Data Processing Module is to enable authorized users to interactively analyze and 
manipulate pre-recorded traffic data through a set of powerful analysis tools (col. 13, lines 
16-19). It would have been obvious to a person having ordinary skill in the art at the time of the 
invention was made to modify Hailpern et al.'s collaborative server by providing for web page 
selections to track specific viruses. 
As per claim 15: 

Hailpern et al. fail to teach a scan log contains no information relating to the direct 
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identification of the client user. Trcka et al, teach the generation of a log file of specific events, 
such as unsuccessful logon attempts (col. 17, lines 37-43). No information about direct 
identification of the client user is mentioned. It would have been obvious to a person having 
ordinary skill in the art at the time of the invention was made to modify Hailpern et al.'s 
collaborative server by preserving the privacy of the client user. 
As per claim 16: 

Hailpern et al. fail to teach that the scan log includes the name of the virus, the frequency 
of its occurrence, and the geographic location of the infected computer. Trcka et al. teach the 
report generation module includes Report Generation Module includes object class libraries for 
allowing the user to select between a variety of display formats, including various graphs, list, 
and tables for the display of report data from the analysis applications (col. 18, lines 62-66). 
These display formats are suited for the presentation of the name of the virus, frequency of 
occurrence, and geographical location. It would have been obvious to a person having ordinary 
skill in the art at the time of the invention was made to modify Hailpern et al.'s collaborative 
server by presenting a tracking scan log with virus information of interest to a client user. 
As per claim 17: 

Hailpern et al. fail to teach a servlet program on the virus-tracking server is used to 
receive the scan-log information from the at least one anti-virus scanning server. Trcka et al. 
teach the report generation module includes object class libraries for allowing the user to select 
between a variety of display formats, including various graphs, lists, and tables for the display of 
report data from the analysis apphcations (col. 18, lines 62-67 and col. 19, Unes 1-5). It would 
have been obvious to a person having ordinary skill in the art at the time of the invention was 
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made to modify Hailpern et al.'s collaborative server by allowing for the download of files to a 
program for anti-virus software. 
As per claim 18: 

Hailpern et al. fail to teach a polling program is used to regularly retrieve virus-tracking 
information from the database server and store it in a data object. Trcka et al. teach examples of 
the types of reports that can be generated using this application include the following: individual 
user activity, application activity, socket activity, transaction activity, logons, and unauthorized 
accesses (col. 20, Unes 13-17). This generation process may retrieve virus information and store 
it for later access. It would have been obvious to a person having ordinary skill in the art at the 
time of the invention was made to modify Hailpern et al.'s collaborative server by allowing for 
the polling of requested virus information and presenting it to the client user for installation of 
appropriate anti-virus programs in one's computers. 
As per claim 19: 

Hailpern et al. fail to teach a common gateway interface program used to retrieve the data 
object for display by the tracking user. Trcka et al. teach traffic capture components, which run 
continuously in the background, to passively generate a data stream that represents the traffic 
present on the network (col. 10, lines 60-66). It would have been obvious to a person having 
ordinary skill in the art at the time of the invention was made to modify Hailpern et al.'s 
collaborative server by reporting and logging information about viruses tracking for the client 
user in order that the client may utilize the information to deploy anti- virus programs. 
As per claim 20: 

Hailpern et al. fail to teach a Java applet running on tracking user browser is used to 
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display a real-time virus-tracing map. Trcka et al, teach three general types of software 
components run on the controller for the purpose of processing traffic data (col. 10, lines 59-60). 
It would have been obvious to a person having ordinary skill in the art at the time of the 
invention was made to modify Hailpern et al.'s collaborative server by adding a Java applet to 
decrease the CPU/modem time required to communicate with the server. 
As per claim 21: 

Hailpern et al. fail to teach the client user is also the tracking user. Trcka et al. teach from 
the screens, the user can specify such parameters as start time/date, end time/date, the types of 
events of interest. The user can specify search criteria and specific fields to be searched and can 
specify an output type of the display screen, the printer, or the file (col. 20, lines 5-12). It would 
have been obvious to a person having ordinary skill in the art at the time of the invention was 
made to modify Hailpern et al.'s collaborative server by allowing the chent user to also be the 
user, thus allowing individuals to set-up web sights and protect their computer fi-om viruses by 
use of the Tracking Center. 
As per claim 22: 

Hailpern et al., Trcka et al., and Tso et al. substantially teach the system as applied to 
claim 12 above. Furthermore, Tso et al. teach the method wherein the distributed computer 
network includes the Internet wherein said scan log from each scanned client computer is sent 
back over the Internet to be received by said virus tracking server, and wherein said real-time 
trace displayed on said tracking user device is made available over the Internet (col. 1, lines 18- 
55 and col. 2, lines 16-53). 
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Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Nadia Khoshnoodi whose telephone number is (571) 272-3825. 
The examiner can normally be reached on M-F: 8:00-4:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Emmanuel Moise can be reached on (571) 272-3865. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for pubUshed applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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